https://bugzilla.redhat.com/show_bug.cgi?id=2529758
Bug ID: 2529758
Summary: CVE-2026-81928 perl-Net-DNS: Net::DNS: Denial of
Service via unbounded recursion with misplaced TSIG
records [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["9dcecf76-99ce-49c4-9bd6-74f8aa357d45"]}
Component: perl-Net-DNS
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected], [email protected]
Blocks: 2527155 (CVE-2026-81928)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded
recursion in sig_data when re-encoding a message with a misplaced TSIG record.
sig_data signs a message by re-encoding it, and removes TSIG records only from
the additional section. A TSIG decoded into the answer or authority section
survives that step and is signed again, so encoding re-enters sig_data with no
termination condition. Decoding does not reject such a message: a TSIG that is
not the last record on the wire raises "misplaced or corrupt TSIG", but the
error is caught, reported as a warning, and the record is left in the packet.
RFC 8945 section 5.2 requires the message to be dropped.
The recursion is reached only when the decoded TSIG carries an empty MAC, since
a MAC recovered from the wire short-circuits the signing step. It is reached
only from code that re-encodes a message it decoded, such as a forwarder or a
proxy. A decoded message that is never re-encoded is unaffected. Message
direction does not matter: a query reaches the same path as a response.
Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire
exhaust available memory and terminate the process.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2527155
[Bug 2527155] CVE-2026-81928 perl-Net-DNS: Net::DNS: Denial of Service via
unbounded recursion with misplaced TSIG records
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2529758
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202529758%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
